Rolino fixed changes

Backlink discovery now checks the final fetched address, so redirects to social or community pages cannot enter the prospect list.

Backlink discovery now skips malformed search-provider rows instead of failing the complete search.

Backlink searches now finish as partial when usable pages were checked, even if one provider request failed.

Backlink opportunity searches now use provider-compatible structured output, analyze large result sets in bounded batches with calibrated scores and exact evidence, preserve usable partial results, start a fresh run after failure, and show clear recovery details instead of a generic error.

Backlink discovery now uses available Search Console queries as topic seeds and saves only independent editorial or resource pages with a specific, high-likelihood external-link placement, excluding competitor product pages, vendor promotions, marketplaces, app stores, forums, and social pages.

The Backlinks dashboard now shows active prospects by default, keeps rejected history in the stage filter, and excludes rejected or declined rows from the main prospect count.

Adding the first backlink target now establishes the project website domain, keeps entered values after a failed save, and explains how to correct an invalid or mismatched URL instead of clearing the form silently.

Backlink verification now accepts claimed pages only from the prospect domain, checks redirected pages again, and prevents an unrelated website from producing a won-link result.

Backlink discovery now honors the requested result limit, stops expired work after three claims, uses production-safe worker time limits, and reports current progress in the dashboard.

Backlink contact research now checks up to five relevant same-domain pages, keeps the public email inside its encrypted evidence excerpt, excludes stale contacts at every read boundary, and supports safe CSV export.

Backlink data deletion now preserves the project audit trail, including a safe record of who completed the deletion.

The Backlinks review screen now uses readable score reasons, editable and copyable outreach drafts, a confirmation before a final decline, and a minimized table payload that excludes contact addresses and draft bodies.

The sign-in page now fits common laptop-height viewports with smaller typography and a more compact card, while long brand names wrap safely inside Home recovery buttons.

Brand Studio now keeps the last completed marketing trend visible during refresh failures, respects disabled data-provider previews, prioritizes the most serious recovery action, and labels each metric with its own data-through date.

Hosted deployments now process queued Search Console and Google Analytics imports every minute, so Marketing overview trends do not remain in the preparing state.

Agent-friendly 404 probing now bypasses Next.js RSC navigation, prefetch, and refresh requests, so brand selection and sign-in links keep their normal client-side navigation without writable-stream errors.

The login page now preserves the TikTok decoration's aspect ratio without a browser image-sizing warning.

The OpenAPI description now derives every success response from the same Zod contract used at runtime, giving all 65 operations exact typed output schemas for agent function calling. The published Rolino skill now also includes an explicit when-to-use section with best-fit jobs and clear non-use boundaries.

Unknown public paths now return short Markdown recovery guidance to non-browser clients while preserving the existing visual HTTP 404 for browsers. Public pages bypass the recovery probe, and the probe no longer forwards an internally decoded response with stale compression headers. The homepage raw HTML now enforces readable text and a valid heading outline.

Rolino's root OAuth discovery URL now redirects to the RFC 8414 path-derived issuer metadata, and public agent documentation now describes the deployed remote MCP and its exact OAuth discovery resources truthfully.

Remote MCP now converts Next.js request objects into plain Web requests before Better Auth verification, preventing production-only private-state failures and restoring standard OAuth challenges.

Remote MCP now passes the real Better Auth instance to its OAuth guard, so unauthenticated initialization can return the standard authorization challenge instead of an internal error.

Session requests now pass the lazy Better Auth instance through the Next.js route adapter correctly instead of failing with `auth is not a function`.

Agent draft creation now uses one shared safety path for API and MCP requests, including durable failed retries and audit records, and deployment readiness now tracks the latest required database migration.

Fresh self-hosted databases now include Better Auth's internal team counters and membership keys, so owner bootstrap and the Compose smoke test can create the default team safely.

Production and container builds no longer need a reachable database to evaluate OAuth discovery routes or render the homepage. Current pricing now loads at request time inside a compact, stable, accessible placeholder while the rest of the homepage stays in the static shell.

Remote MCP never registers media or Blog image tools that read a caller-local file path; local stdio keeps both upload workflows.

API and MCP OAuth tokens now fail closed when used for the other resource, and OAuth scope failures return standard discovery challenges without weakening workspace, confirmation, idempotency, or audit checks.

Agent API errors now keep the same structured recovery contract for delivery authentication, unknown namespace roots, unsupported HTTP methods, and production edge failures, including matching request IDs, accurate OpenAPI success statuses, and contract version 0.17.0.

Public changelog pages now preserve wrapped entry text, publish exact pagination canonicals, and expose every category page through the sitemap.